28 July 2021

28 results · Feed

• Unscored —
  CVE-2020-15948

  eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.

  Jul 28, 2021
• Unscored —
  CVE-2021-37606

  Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision…

  Jul 28, 2021
• Unscored —
  CVE-2020-21854

  Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page.

  Jul 28, 2021
• Unscored —
  DRUPAL-CONTRIB-2021-024

  This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The admin…

  drupal/pages_restriction Packagist
  Jul 28, 2021
• High 7.5
  CVE-2021-23415

  Directory Traversal

  This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.

  elFinder.AspNet NuGet
  Jul 28, 2021
• Medium 5.4
  CVE-2021-23416

  Cross-site Scripting (XSS)

  This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.

  curly-bracket-parser npm
  Jul 28, 2021
• Medium 5.6
  CVE-2021-23417

  Prototype Pollution

  All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.

  deepmergefn npm
  Jul 28, 2021
• Unscored —
  CVE-2021-25200

  Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbi…

  Jul 28, 2021
• Unscored —
  CVE-2021-34166

  A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authenticati…

  Jul 28, 2021
• Unscored —
  CVE-2021-34165

  A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authenticati…

  Jul 28, 2021
• High 7.5
  CVE-2021-37601

  muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, m…

  prosody prosody prosody Debian Ubuntu Alpine
  Jul 28, 2021
• Medium 5.4
  CVE-2020-5004

  IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…

  IBM Rational Collaborative Lifecycle Management Rational Quality Manager Rational DOORS Next Generation
  Jul 28, 2021
• Medium 6.3
  CVE-2020-4974

  IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated atta…

  IBM Rational Collaborative Lifecycle Management Rational Quality Manager Rational DOORS Next Generation
  Jul 28, 2021
• Unscored —
  CVE-2020-10590

  Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Co…

  Jul 28, 2021
• Low 3.2
  CVE-2021-32000

  clone-master-clean-up: dangerous file system operations

  A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary fil…

  SUSE openSUSE Factory SUSE Linux Enterprise Server 15 SP1 Linux
  Jul 28, 2021
• Medium 6.5
  CVE-2021-32001

  K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token

  K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and…

  SUSE Rancher k3s Alpine
  Jul 28, 2021
• Medium 6.5
  CVE-2021-23414

  Cross-site Scripting (XSS)

  This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

  video.js npm
  Jul 28, 2021
• Unscored —
  CVE-2021-36983

  replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp…

  Jul 28, 2021
• Unscored —
  CVE-2021-20789

  Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, …

  Japan Total System GroupSession
  Jul 28, 2021
• Unscored —
  CVE-2021-20788

  Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the versio…

  Japan Total System GroupSession
  Jul 28, 2021
• Unscored —
  CVE-2021-20787

  Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver…

  Japan Total System GroupSession
  Jul 28, 2021
• Unscored —
  CVE-2021-20786

  Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version…

  Japan Total System GroupSession
  Jul 28, 2021
• Unscored —
  CVE-2021-20785

  Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver…

  Japan Total System GroupSession
  Jul 28, 2021
• Unscored —
  CVE-2021-20783

  Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the aut…

  SoftBank Optical BB unit E-WMTA2.3
  Jul 28, 2021
• High 7.5
  CVE-2020-5351

  Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges tha…

  Dell Data Protection Advisor
  Jul 28, 2021
• Critical 9.8
  CVE-2020-5341

  Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.…

  Dell Avamar Virtual Edition
  Jul 28, 2021
• Medium 6.3
  CVE-2020-26180

  Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an…

  Dell PowerScale OneFS
  Jul 28, 2021
• Unscored —
  CVE-2021-37600

  An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to us…

  util-linux util-linux util-linux Debian Ubuntu Alpine
  Jul 28, 2021